An Introduction to Cellular Security Joshua Franklin Last Changed: 20140121 Intro License Creative Commons: Attribution, Share-Alike http://creativecommons.org/licenses/by -sa/3.0/ 2 Intro Introduction • Cellular networks are a dense subject – This is not a deep dive • The standards are large, complicated documents • Involves physics, telecommunications, politics, geography, security... • We will discuss older cellular networks first and build upon this knowledge • The GSM, UMTS, and LTE standards are more or less backwards compatible – Major consideration during standards development 3 Intro Who Am I? • Joshua Franklin • I hold a Masters in Information Security and Assurance from George Mason – Graduate work focused on mobile operating systems • I work in election and mobile security 4 Intro Learning Objectives • Become familiar with the GSM, UMTS, and LTE family of cellular standards • Be introduced to spectrum allocation and antennas • Learn the security architecture of cellular networks • Be introduced to how cellular networks have been hacked in the past We will deeply explore LTE security while only touching on GSM and UMTS. LTE is the new standard moving forward (a.k.a., the new hotness). Previous cellular standards are being phased out. 5 Intro Excluded Topics This class does not cover: • Wireless physics • Ancient wireless networks (AMPS, IMS, smoke signals ) • Wired systems (PSTN/POTS/DSL) • Standards other GSM, UMTS, and LTE – CDMA2000, EV-DO, WiMax • In-depth discussion of GPRS, EDGE, and HSPA variants • SMS and MMS (text messaging) • Mobile operating systems (iOS, Android, Windows Phone) • QoS , Mobility management, and VoLTE • Internetwork connections Warning: This class is U.S.-centric but the standards are used worldwide. The network operators, frequencies, and implementations vary. 6 Intro Books Wireless Crash Course LTE Security LTE-Advanced for Mobile 3rd edition 2nd edition Broadband - 2nd edition Easy Mode Intermediate God Mode Note: Many papers and presentations were also useful and are cited inline, but check the last slide for a complete listing. 7 Intro Terminology • Cellular standards use jargon and abbreviations frequently – LTE, EPS, BTS, K[ASME] – Nested acronyms are common – GERAN = GPRS Evolution Radio Access Network – LTE is often referred to as Evolved Packet System (EPS) in technical situations • Learn to be comfortable with the jargon and acronyms – There is an associated glossary and cheatsheet – If something needs to be added or modified, please let me know – Especially to improve the course and associated documentation 8 Intro Prerequisites 1. Basic understanding of networks and network protocols 2. Familiar with core cryptographic concepts 3. Basic knowledge of information security 4. Basic understanding of physics 5. Have made a phone call There are no labs in this class 9 Intro Agenda • Wireless spectrum and cellular bands • Important cellular concepts • Overview of cellular standards • Discussion of the following for GSM, UMTS, and LTE: – Network components – Security architecture (hardware tokens, authentication, cryptography) – Threats to these technologies – Notable attacks • SIM Hacking • Baseband Hacking • Femtocells 10 Intro What is LTE • LTE is Long Term Evolution • Fourth generation cellular technology standard from the 3rd Generation Partnership Project (3GPP) • Deployed worldwide and installations are increasing • All implementations must meet baseline requirements – Increased Speed – Multiple Antennas (i.e., MIMO) – IP-based network (All circuits are gone/fried!) – New air interface: OFDMA (Orthogonal Frequency-Division Multiple Access) – Also includes duplexing, timing, carrier spacing, coding... • LTE is always evolving and 3GPP often drops new “releases” – This class is modeled around LTE-Advanced, but we won’t dig deep enough to tell 11 Intro Cellular Network Operators • Telecommunications company (telco) – Purchases spectrum – Builds out network (base stations and backhaul network) – Verizon, AT&T, T-Mobile, Sprint • Mobile Virtual Network Operator (MVNO) – Does not have to purchase spectrum – Rents the towers but runs a distinct network – Cricket, Ting, MetroPCS, ... 12 Spectrum Radio Frequency Spectrum • Describes a range of frequencies of electromagnetic waves used for communication and other purposes • RF energy is alternating current that, when channeled into an antenna, generates a specific electromagnetic field. • This field is can be used for wireless communication • Cellular spectrum ranges from 300 MHz to 3 GHz 13 Spectrum EM Spectrum Thanks to Wikipedia 14 Spectrum Wireless Spectrum From an interactive map available via the FCC 15 Spectrum Popular Cellular Bands • 700 Mhz Band (Blocks A - E) – Considered uniquely useful to cellular activities – Verizon, US Cellular, AT&T and others own various portions – Will be used for 4G – Includes reserved spectrum for public safety • 850 MHz – Great for cellular service – Easily bounces off objects • 1900 MHz band (PCS) • 2100 MHZ (Blocks A - F) – Mostly T-Mobile, but includes Cricket and MetroPCS • This information changes periodically as spectrum is purchased & released 16 Spectrum Chipset • In the past, phones have typically been tied to a single carrier • A phone’s hardware is tied to a carrier based on many things (like the IMEI), but the major ones are the cellular standard and frequencies the carrier uses • Phones are manufactured to work on specific radio frequencies – Specific chips needed for a given frequency range, thus chipset • Nowadays, phones concurrently operate on many frequencies (and therefore networks) – Modern multi-band chips allow a single device to operate on multiple frequency ranges 17 Spectrum Channel Allocation • Typically there is a downlink channel and an uplink channel • These channels needs to be spaced in frequency sufficiently far so that they do not interfere with each other Uplink Downlink 18 Spectrum Antenna • There are 2 main types of antennas, each with unique properties • Omnidirectional – Emits energy in a spherical radius • Directional – Emits energy in the shape of the antenna and in the direction and angle at which it is pointed 19 Spectrum Directional Antenna • Designed to radiate in a specific direction – The radiation is focused (see below) • There are “panel” direction antennas on the front cover of this presentation 20 Spectrum Omnidirectional Antenna • Designed to radiate in across a specific plane – The radiation spreads outward from a center point – A donut is a reasonable visual 21 Spectrum Device Antenna • There are multiple antenna in your mobile device - although some are shared • Designed to transmit and receive at various frequencies – Cellular (300 MHz - 3 GHz) – WiFi (Primarily 2.4 GHz, 5 GHz) [there are other odd frequencies specified] – Bluetooth (2400–2480 MHz) – NFC (13.56 MHz) 22 Spectrum Multiple Antennas • LTE has a feature called Multiple-Input Multiple- Output (MIMO) • Multiple antennas are on the mobile device and are used simultaneously to transmit and receive – Can significantly increase throughput • Multiple types – Spatial diversity – Spatial multiplexing • Further divided: – SISO - Single in, single out – SIMO - Single in, multiple out – MISO - Multiple in, single out – MIMO - Multiple in, multiple out 23 Important Concepts Concepts Big Picture Mobile devices (1) connect to a base station (2) which connects to a backhaul network (3), which connects to the internet (4). 1 2 3 4 25 Concepts Network Components • The network between mobile devices and base stations is the Radio Access Network (RAN) – This name slightly changes with new standards • Base stations are permanent cellular sites housing antennas • Base stations and the backhaul network are run by telco, but there are interconnections and shared sites – AT&T customers need to be able to contact Verizon (vice versa) • Base stations often connect to backhaul via wired technologies (i.e., fiber) – Base stations often communicate with each other via wireless 26 Concepts Mobile Devices • These are the devices with wireless radios that connect to cell towers – Radios are inside phones, tablets, laptops, etc. • LTE uses the term User Equipment (UE), previously ~ Mobile Station (MS) • The parts of the UE we are concerned with: – The handset, aka the ME (Mobile Equipment) – USIM (Universal SIM) – Baseband processor 27 Concepts Baseband • Typically a separate processor on the phone – From companies like Qualcom, Infineon, etc. • Handles all of the telecommunications-related functions – Sends, receives, processes signals – Base station and backhaul network communication – Has direct access to microphone, speakers… • Runs a real time operating system (RTOS) – Performance matters! – OSs include ThreadX, Qualcomm’s AMSS w/ REX kernel, OKL4 • Sometimes shares RAM with application processor (baseband as a modem), sometimes each processor has distinct RAM(shared architecture) – In a shared configuration the baseband is often the master • May be virtualized 28 Concepts Planes of Communication • Many control systems divide communication into two planes - one for processing information from users and another for how to setup/breakdown the channel and other important functions • Think of this similar to how FTP uses two ports – TCP port 20 - data – TCP port 21 - control • Control Plane (CP) – A private communication channel that is distinct from data the UE operator can influence – Used to send control messages to components – Mobile users should not be able to influence this in any way • User Plane (UP)